Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds In the function init_conns(), after the create_con() and create_cm() for loop if something fails. In the cleanup for loop after the destroy tag, we access out of bound memory because cid is set to clt_path->s.con_num. This commits resets the cid to clt_path->s.con_num - 1, to stay in bounds in the cleanup loop later.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6a98d71daea186247005099758af549e6afdd244 to < 0429a4e972082e3a2351da414b1c017daaf8aed2affected6a98d71daea186247005099758af549e6afdd244 to < 5ac73f8191f3de41fef4f934d84d97f3aadb301faffected6a98d71daea186247005099758af549e6afdd244 to < 01b9be936ee8839ab9f83a7e84ee02ac6c8303c4affected6a98d71daea186247005099758af549e6afdd244 to < 1c50e0265fa332c94a4a182e4efa0fc70d8fad94affected6a98d71daea186247005099758af549e6afdd244 to < c8b7f3d9fada0d4b4b7db86bf7345cd61f1d972eaffected6a98d71daea186247005099758af549e6afdd244 to < 3e4289b29e216a55d08a89e126bc0b37cbad9f38affected
Linux Linux
Default version status: affected
5.8affected0 to < 5.8unaffected5.15.168 to ≤ 5.15.*unaffected6.1.113 to ≤ 6.1.*unaffected6.6.54 to ≤ 6.6.*unaffected6.10.13 to ≤ 6.10.*unaffected6.11.2 to ≤ 6.11.*unaffected6.12 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0429a4e972082e3a2351da414b1c017daaf8aed2 ↗
- https://git.kernel.org/stable/c/5ac73f8191f3de41fef4f934d84d97f3aadb301f ↗
- https://git.kernel.org/stable/c/01b9be936ee8839ab9f83a7e84ee02ac6c8303c4 ↗
- https://git.kernel.org/stable/c/1c50e0265fa332c94a4a182e4efa0fc70d8fad94 ↗
- https://git.kernel.org/stable/c/c8b7f3d9fada0d4b4b7db86bf7345cd61f1d972e ↗
- https://git.kernel.org/stable/c/3e4289b29e216a55d08a89e126bc0b37cbad9f38 ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗